I guess we will make use of nftables when the firewall codebase is rewritten. That rewrite is a major effort and on the roadmap - but it does not have momentum/priority yet due to limited resources.

Would like to contribute?

wow christian, to move from iptables to nftables is not a small project.
As far I remember vyos has a quite complex iptables chains.
Bu in fact, I'm quite disconnected from vyos.

I would like to help if I had some free time, but something small.

@elbuit
Rolling is support nft now.

vyos@mpls:~$ sudo nft -v
nftables v0.9.0 (Fearless Fosdick)

There are examples and descriptions that you would like to see in the system?

Thanks @Viacheslav, I've build a custom vyos 1.2.4 with nftables package because I want to add custom rules in nftables mode.

Rolling uses a iptables - nftables wrapper that converts iptables to nft, but I think that firewall needs to be rewritten from zero, and clean it. There are other sections that depends on iptables (ie: flow accounting, connection tracking,..)

The think I like of nftables is "compiled" before be applied, and if "compilation" fails ruleset won't be applied ( That is quite similar to FreeBSD pf)
For that, to convert all vyos rules to a nft file and then compile and apply it could be an acceptable implementation, even if you only add a single rule.

If compilation works it applies new ruleset, if not, previous ruleset is maintained.

That implementation is not as complicated as we have now in current vyos, and most of it could be done with a jinja2 template.

@elbuit

vyos@mpls# sudo nft list table nat
table ip nat {
	chain PREROUTING {
		type nat hook prerouting priority -100; policy accept;
		counter packets 0 bytes 0 jump VYATTA_PRE_DNAT_HOOK
	}

	chain INPUT {
		type nat hook input priority 100; policy accept;
	}

	chain POSTROUTING {
		type nat hook postrouting priority 100; policy accept;
		counter packets 0 bytes 0 jump VYATTA_PRE_SNAT_HOOK
	}

	chain OUTPUT {
		type nat hook output priority -100; policy accept;
	}

	chain VYATTA_PRE_DNAT_HOOK {
		counter packets 0 bytes 0 return
	}

	chain VYATTA_PRE_SNAT_HOOK {
		counter packets 0 bytes 0 return
	}
}
[edit]
vyos@mpls#

Let us know if you need help.

Latest rolling has nftables 0.9.6 - closing this